First, the Citrix Java Client can run with no special rights (ie locked down kiosk PCs) the only way to avoid this is to disable Java in the browser and lock it down so the user can not re-enable it.
Second, the Citrix Web Client will install just for the user that runs it if he/she does not have rights to the PC, it becomes an add-in to the user's Internet Explorer. This requires no admin rights.
It sounds like you want to avoid both these situations? If that's the case may I suggest you look to locking down the PC's Internet Explorer (namely Java and allowing users to run ActiveX / install web applications). The Internet Explorer Administrator Kit is your best bet (as well as using GPOs/Local Security policies) - all the info you need is right here:
http://technet.microsoft.com/en-us/ie/bb219517.aspx